v0.149.118

• Let a project's seccompPolicy override the declaration again, seccomp.deny included, by design: the declaration is the ready-made fit, written once for every project it launches, and a project's policy the tailored one, computed at launch for this checkout, so where they disagree the project wins; flong-seccomp project is given namesFor's names once more, deny already taken out, in place of d73509f's projectNamesFor and its -X lines, which are gone, so a project allow puts back a call seccomp.deny removed and a log logs one, as before d73509f, and 8a01ab3's notice ("seccomp.deny refuses what the project allows") is gone with the binding it said; base none now starts from no names at all rather than from the declaration's denies, and is still refused when its allows leave nothing; log, nolog, base none and flong-seccomp resolve are otherwise as they were, their line syntax unchanged; the option's doc, SeccompProject.names, Seccomp.deny and DESIGN say the project's lines override the declaration, deny included, and that a declaration which must keep a call refused leaves seccompPolicy empty or has its commands refuse such a policy, in place of the binding, the "until 2026-10-02" note and the old "deny as -name", which described a names file that never carried deny's entries; the project-declared-deny-* golden cases and strict-deny-ptrace.names give way to project-over-declared-deny, an allow and a log over expand-strict-deny's names, its policy checked when written against one rendered from flong-seccomp expand and its filter against compiling that policy directly, and rootless-b sees a declaration's deny refuse ptrace alone and a project's allow ptrace put it back, nothing said (d74285c)
• Answer the seccompPolicy review: base none whose allows leave nothing is refused by flong-seccomp project itself ("base none allows nothing: name at least one call with allow"), before the compiler meets the empty allow line of a policy nobody wrote, quirk 35 kept for the bash's own case of NAMES empty; a project allow the declaration's seccomp.deny overrides is said on stderr ("seccomp.deny refuses what the project allows: X...") and the launch goes on with the call refused, since until d73509f such an allow put the call back and an existing project that relied on it would otherwise lose it quietly -- a log naming one is not said, log @known naming every one; the option's doc says a project deny leaves a call to log unless nolog names it too, as project.zig always did, and that under seccomp.log every refused call is rendered log, deny's included, so the binding holds against the project's lines and not against seccomp.log; DESIGN puts the lost records down to printk's rate limit on the kernel log when no auditd runs, which journald's audit socket and auditd, reading the audit netlink, do not meet (audit_rate_limit is 0 by default; the backlog can still overflow in a large burst), in place of the audit rate limit; golden cases for both refusals and the notice, and rootless-b sees the notice from a live launch (8a01ab3)
• Let a project's seccompPolicy learn a policy at launch and keep the declaration's deny binding it: log X... renders each call of @known it names that the filter would refuse as log in place of the declaration's errno (allowed, and audited as type=1326), nolog X... takes names back out whatever order the two come in, and base none applies the lines to no names in place of the declaration's, so base none, a hot set's allow and log @known log every other call of @known while log @known alone learns against the profile; calls outside @known stay ENOSYS and the audit, tty and namespace filters stay hard; the declaration's seccomp.deny now reaches flong-seccomp project as -X lines after the names (policy.nix's projectNamesFor, the names file itself when deny is empty), so no project allow puts back and no log logs what deny took, as the option and SeccompProject.names already said and the expanded names file could not; flong-seccomp resolve ARCH NR names a record's arch= and syscall= by libseccomp's tables, x32 as audit reports it (x86_64's arch, 0x40000000 in the number), offered as the flake's packages..seccomp; with no log, nolog or base line the policy, its key and its filter are render's, byte for byte, and the golden tooling cases recorded from the bash pass unchanged but for the line refusal and the usage, which now name the new words; new golden cases each checked when written against a policy built from flong-seccomp expand and a direct compile, and rootless-b shows log and nolog live, a log learned from nothing, resolve naming what was logged, and a declared deny holding against a project's allow and log (d73509f)